Privacy Policy

We collect the following categories of information when you use Super.family:

• Account and identity: your name, email address, phone number, date of birth, password, and other profile details you provide when creating or updating your account.
• Health and wellbeing data (treated as sensitive personal data under Indian law): your goals, weight, vitals, sleep patterns, nutrition and food logs, fitness activity, mental wellbeing inputs, and any symptoms or health conditions you choose to share with the platform.
• Wearable and device data: if you connect a wearable device via the Sahha integration, we receive activity metrics, sleep data, heart rate readings, readiness scores, and similar measurements. This data is collected only if you choose to connect a device.
• Blood and lab reports: documents you upload, and the biomarker values our OCR service extracts from them, together with any trends we identify across multiple reports over time.
• Family and dependants' data: information you add for people you manage on the platform, including children, such as vaccination records, prescriptions, appointments, and health documents.
• Family Vault documents: files you store in the Family Vault are encrypted on your own device before they leave it. We do not have access to the contents of your Vault documents.
• AI coach conversations and human coach notes: the messages you exchange with the Super.family AI coach, together with any notes from human coach sessions you book through the platform.
• Usage, device, and log data: IP address, browser type, device identifiers, pages visited, actions taken, and error logs, collected automatically when you use the platform.
• Payment information: billing details are collected and processed by our third-party payment processors. We do not store full card numbers or sensitive payment credentials on our servers.

We use the information we collect for the following purposes:

• Delivering and personalising the platform, including generating your nutrition, fitness, sleep, and mental wellbeing plans.
• Powering AI coaching, insights, and recommendations tailored to your individual data.
• Enabling human coaches to review your AI-generated plans and to provide optional progress reviews.
• Sending you reminders, notifications, and service communications relevant to your plan and goals.
• Keeping the platform safe, detecting fraud, and protecting users from harm.
• Improving the quality, accuracy, and personalisation of the service over time.
• Complying with applicable laws, resolving disputes, and enforcing our agreements.

We do not sell your personal data to third parties. We do not serve targeted advertising on Super.family, and we do not run targeted advertising directed at children.

Super.family uses AI models to generate personalised plans and insights. Some of these models are operated by third-party AI providers under contract with Wholistix Technologies Private Limited. When we use such providers, we share only the minimum data necessary to complete the relevant task, and they are contractually prohibited from using your identifiable health data to train their publicly available models.

Every AI-generated plan is also reviewed by a certified human coach before it is finalised. Human coaches may have access to the data relevant to your plan for this purpose.

The Family Vault uses on-device encryption. Your Vault documents are encrypted before they leave your device, and the encryption keys are held on your device, not on our servers. This means Wholistix Technologies Private Limited cannot read the contents of your Vault.

Vault documents are shared only with people you explicitly choose to share them with. If you lose access to your device or credentials, we cannot recover your Vault contents.

If you add a child or another person to your account, you represent that you have the legal authority and appropriate consent to do so. For children, the account holder (parent or guardian) is responsible for managing their data consistently with applicable law, including India's Digital Personal Data Protection Act 2023.

We do not knowingly collect data directly from children without parental or guardian consent. If you believe data has been submitted about a child without appropriate consent, please contact us immediately at hello@getsuper.family so we can take appropriate action.

We share your personal data only in the following circumstances:

• Your care team or coaches: with your explicit consent, we may share relevant health data with human coaches you engage through the platform or clinicians you add to your care team.
• Service providers and sub-processors: we engage providers for cloud hosting (Microsoft Azure), database services, the Sahha wearable integration, AI model processing, push and email communications, and payment processing. All processors are bound by data processing agreements that restrict their use of your data to the purposes for which it was shared.
• Legal and safety reasons: we may disclose data when required by law, court order, or governmental authority, or where reasonably necessary to protect the safety of any person.
• Business transfers: if Wholistix Technologies Private Limited is involved in a merger, acquisition, or asset sale, user data may be transferred as part of that transaction. We will notify you before your data becomes subject to a materially different privacy policy.

We do not otherwise share, sell, or disclose your personal data to third parties.

Super.family is hosted on Microsoft Azure infrastructure. Your data may be processed in India and in other countries where our service providers operate their infrastructure. Where personal data is transferred internationally, we implement appropriate safeguards — such as standard contractual clauses or equivalent mechanisms required under applicable law — to ensure your data receives an appropriate level of protection regardless of where it is processed.

We retain your personal data for as long as your account is active and as necessary to provide the service, comply with legal obligations, resolve disputes, and enforce our agreements. If you delete your account, we will delete or anonymise your personal data within a reasonable period, subject to any legal or regulatory obligations that require us to retain it for longer.

Backups and system logs are retained for limited periods as required for operational and security purposes and are then deleted. Anonymised or aggregated data, from which you cannot be identified, may be retained indefinitely for service improvement purposes.

We implement appropriate technical and organisational measures to protect your personal data, including encryption in transit (TLS), encryption at rest, access controls limiting staff access to personal data to those who need it to perform their role, and on-device encryption for the Family Vault.

No system is perfectly secure. If you have reason to believe your account has been compromised or that your data has been accessed without authorisation, please contact us immediately at hello@getsuper.family.

Depending on where you are located, you have a range of rights in relation to the personal data we hold about you. To exercise any of these rights, email us at hello@getsuper.family. We will respond within the timeframe required by applicable law.

General rights

Regardless of your location, you have the right to request access to the personal data we hold about you, to request correction of inaccurate or incomplete data, and to withdraw consent at any time where our processing is based on your consent.

India — Digital Personal Data Protection Act (DPDP Act) 2023

If you are in India, you have the right to access information about the personal data we process about you, to request correction or erasure of your data, to nominate another person to exercise your rights on your behalf, and to seek grievance redressal through our Grievance Officer. Our Grievance Officer can be contacted at: [Grievance Officer name], Wholistix Technologies Private Limited, hello@getsuper.family.

European Economic Area and United Kingdom — GDPR

If you are in the EEA or the UK, we process your personal data on the following legal bases: contract performance (to deliver the service you have requested), legitimate interests (security, fraud prevention, service improvement), consent (for health and sensitive data, and for marketing communications), and legal obligation. Under GDPR, you have the rights of access, rectification, erasure, restriction of processing, data portability, and objection. You also have the right to lodge a complaint with the supervisory authority in your country.

When you use our web platform, we use cookies and similar technologies. Essential cookies are required for the platform to function correctly. We also use limited analytics cookies to understand how the platform is used and to improve it over time.

You can control or delete cookies through your browser settings. Disabling essential cookies may affect your ability to use the platform. We do not use cookies for third-party advertising or behavioural tracking.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. When we do, we will post the updated version on this page and update the 'Last updated' date at the top. We encourage you to review this policy periodically. If changes are material, we may notify you by email or through the app.

If you have questions, concerns, or requests relating to this policy or the personal data we hold about you, please contact:

• Wholistix Technologies Private Limited
• Unit No 203, Second Floor, Suite #360, SBR CV Towers
• Sector-1, Sy No 64, HUDA Techno Enclave
• Madhapur, Hyderabad 500081, India
• Email: hello@getsuper.family
• Grievance Officer: [Grievance Officer name]